September 6, 2026 · 8 min read
TL;DR: The risk slice in this bank is 129 questions, and it is not a name-the-strategy topic. Mitigate, transfer, avoid and accept appear in 46 options between them; exploit appears once and enhance never. What the questions turn on is one fact in the stem: was this risk identified during planning? If yes, consulting the register and carrying out the planned response is keyed 19 times. If no, the keyed answer assesses it and gets it into the register first. An option that acts immediately is offered 11 times and keyed once.
Two questions in this bank describe almost the same situation and have opposite answers. In the first, an organizational change programme meets internal resistance, and the stem says the project manager identified and planned for that resistance during planning. In the second, a vendor with a documented history of quality problems misses acceptance criteria for the second time, and the stem says the project manager checks the register and finds the vendor's quality history was never logged. One sentence separates them, and it decides everything that follows.
Whether the risk was identified during planning. The exam builds the whole answer set around that one fact.
In the resistance question, four options are on the table: work with the sponsor to reorder the backlog, ask the sponsor to escalate to the executive committee, run a root cause analysis of the manager's resistance, or carry out the risk response that was already planned. The keyed answer is the planned response, and the explanation is precise about why the root cause analysis fails. It would be the right first move for a risk nobody had anticipated. Here the analysis was already done, at planning time, by the same project manager now being asked to redo it.
In the vendor question, the options are reject the deliverable and demand rework at the vendor's cost, add the risk to the register and assess it before deciding on a response, escalate to procurement for contract default, or absorb the rework quietly. The keyed answer is the register one. Three options pick a remedy for a risk that has never been assessed, so none of them can know whether the remedy fits.
| The stem says | Keyed move | Keyed | Offered as a distractor |
|---|---|---|---|
| The risk was identified in planning | Consult the register, execute the planned response | 19 | 12 |
| The risk was never identified | Add it to the register and assess it first | 5 | 4 |
| Something already happened, workaround in place | Log the issue, update the register to reflect reality | 5 | 8 |
| Any of the above | Act on it immediately | 1 | 10 |
| Any of the above | Notify the sponsor or stakeholders first | 1 | 7 |
Common trap: treating urgency in the stem as permission to skip the register. A quality problem with a key supplier sounds like something to fix this morning, and one question makes exactly that offer: call an urgent team meeting to brainstorm solutions, request an immediate full quality audit, or draft an urgent message demanding a rectification plan. All three are wrong, because the stem says the supplier risk had been identified earlier in the project. The keyed answer refers to the register for the predetermined mitigation actions. In this bank an option carrying "immediately" is offered 11 times and keyed once, so the word is a reliable warning that the option is skipping a step.
Because it answers a funding question the stem has not yet asked. Options that reach for contingency reserve or draw down a buffer appear 24 times in this slice and are keyed 5 times, one of the worst ratios in the topic.
The reserve is real and it is there for identified risks, which is exactly what makes it tempting. But spending it is the execution of a response, and a response has to exist and fit before the money moves. In the questions where a reserve option is keyed, the risk is identified, the response is known and the reserve is what the response consumes. In the 19 where it is a distractor, the project manager is reaching for money before establishing what the problem is.
The same logic explains why brainstorming meetings do badly here, keyed 2 times against 9 appearances as a distractor. A meeting is what you hold when you do not know what to do. If the register already says what to do, the meeting is a way of not reading it.
No, and two questions in this bank test the opposite directly.
In the first, an important deliverable on a critical project arrives ahead of its due date. A late delivery would have hit the critical path, so this is good news. The options are tell the stakeholders at the next status meeting, review the risk register and lower the ranking of the corresponding risk, close the entry in the issue log, or update the schedule baseline. The keyed answer lowers the ranking. The explanation notes that nothing ever became an issue, so there is no log entry to close, and a deliverable arriving early does not move a baseline.
In the second, a bridge retrofit is well into its final stage, every high-level risk is resolved or no longer applies, and only low-level risks remain. Three options invite you to relax: lower the priority given to project risks, notify stakeholders that the high-level risks are closed out, or reclassify the remaining low ones as high. The keyed answer re-evaluates the identified risks and updates the register, because a risk's rating is only as good as its last review, and standing down because the register currently looks quiet is how a late surprise arrives.
Both questions test the same underlying idea. The register is a live document that tracks the project's actual risk exposure in both directions, and the exam checks whether you maintain it when the news is good.
How do I know which risk response strategy to pick? Most of these questions do not ask. Across 120 multiple-choice risk questions, mitigate appears in 22 options, transfer in 12, accept in 9, avoid in 3, exploit in 1 and enhance in none. The test is sequence, not vocabulary.
Should I tell the sponsor when a risk occurs? Rarely first. Informing or notifying a sponsor or stakeholder appears 8 times and is keyed once. Communication is keyed when the decision belongs to somebody else and is a distractor when it substitutes for action you can take.
What do I do when a risk occurs that nobody identified? Get it into the register and assessed before choosing a remedy. If the team already improvised a workaround, log the event as an issue and update the register to show what actually happened.
Does the risk register only get updated when things go wrong? No. A deliverable arriving early lowers a risk ranking, and a quiet late-stage register still gets re-evaluated.
The 129 risk questions in this bank are certified against PMBOK 8 and the July 2026 exam content outline, and each one tells you which sentence in the stem decided the answer, every wrong answer explained rather than just marked wrong. Start the free 20-question sample with no card and no signup.
Related reading: Risk Management: Probability and Impact and Change Requests: Who Approves What. The domain breakdown is on the Business Environment study page.
Sources: PMI, Project Management Professional (PMP) Exam Content Outline
How do I know which risk response strategy to pick?
On this bank's evidence, most risk questions do not ask you to pick one. Across the 120 multiple-choice risk questions, mitigate appears in 22 options, transfer in 12, accept in 9, avoid in 3, exploit in 1 and enhance in none. The strategy names are the vocabulary, not the test. What the questions actually turn on is sequence: whether the risk was identified in advance, and therefore whether a response already exists to execute.
Should I tell the sponsor when a risk occurs?
Rarely as the first move. Options that inform or notify a sponsor, stakeholder or senior manager appear 8 times across these questions and are keyed once. The pattern is consistent with the rest of the bank: communication is the right answer when the decision belongs to somebody else, and a distractor when it substitutes for action the project manager is able to take.
What do I do when a risk occurs that nobody identified?
Get it into the risk register and assessed before choosing a remedy. One question describes a vendor with a documented quality history that was never logged as a risk, so no planned response exists. Rejecting the deliverable, escalating to contract default and absorbing the rework are all offered; the keyed answer adds the risk to the register and assesses it first. If the team already improvised a workaround, the keyed answer records the event in the issue log and updates the register to show what actually happened.
Does the risk register only get updated when things go wrong?
No, and the exam tests this directly. One question has a critical deliverable arrive early, removing a threat to the critical path. The keyed answer reviews the risk register and lowers that risk's ranking. Another has a project in its final stage with only low-level risks left, where the keyed answer re-evaluates the remaining risks and updates the register rather than standing down. Registers are maintained as conditions improve, not only as they deteriorate.